docs: add an MIT license and require NEXT_PUBLIC_API_URL in production builds

[PunGrumpy]

Why

Two independent gaps.

The repository is public with no LICENSE file, so default copyright applies and nobody may legally use, fork, or contribute to the code. MIT matches the convention across this account's other repositories.

apps/web/env.ts gave NEXT_PUBLIC_API_URL a .default("http://localhost:3001"). Next.js inlines that value into the client bundle, so forgetting to set the variable produced a green production build whose users' browsers posted every image to their own machine, with the status link pointing there too. A default defeats the point of the validated-env boundary: the failure belongs at build time, not in a user's browser.

What changed

• LICENSE (MIT), a license field on the root manifest, and a License section in the README.
• env.ts requires the variable when NODE_ENV is production and keeps the localhost default otherwise, so next build fails without it while bun dev stays zero-config.
• next.config.ts reads the raw variable for the development rewrite instead of importing the validated module. next typegen loads the config with NODE_ENV=production, so importing the module there would have made bun run typecheck require a production-only variable for every contributor. Application code still imports @/env, which is what triggers validation during a build.
• Both CI workflows pass NEXT_PUBLIC_API_URL to their Build step, making explicit the value they previously got from the removed default. CI builds are never deployed, so a placeholder is correct there.

Verification

Case	Result
bun run typecheck with the variable unset	exit 0
bun run build with the variable unset	exit 1, "Invalid environment variables"
bun run build with a valid URL	exit 0
bun dev with no env file	server boots

Root bun run test and bun run check both exit 0.

Note for deployment

Any deployment of the web app must now set NEXT_PUBLIC_API_URL in its platform environment. On Vercel this is a project setting; the build fails without it, which is the intent.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pigo	Ready	Preview	Aug 30, 2026 3:50am
pigo-api	Ready	Preview	Aug 30, 2026 3:50am

[changeset-bot]

⚠️ No Changeset found

Latest commit: 989e1aa

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 989e1aa.}